Description

An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Failure to track admin actions related to design configuration could lead to repudiation attacks.

Remediation

References

CVE-2019-8124

Related Vulnerabilities

Drupal Core 9.2.x Directory Traversal (9.2.0 - 9.2.1)

Apache Traffic Server Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2023-33934)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-9062)

OpenSSL Other Vulnerability (CVE-2007-3108)

WordPress Plugin GTM4WP Cross-Site Scripting (1.9)

Severity

High

Classification

CVE-2019-8124 CWE-345 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities